Edit tour

Windows Analysis Report
original (2).eml

Overview

General Information

Sample name:	original (2).eml
Analysis ID:	1523383
MD5:	e924e6aa535ccb1b496ae76c0a322732
SHA1:	dffc35f649765d20ada3095b4f774b5d64b6fdc1
SHA256:	e9ae0bfde26b6979061e53b5842bb0076e428e7e7ecb604e13c016ee9486281d
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Suspicious MSG / EML detected (based on various text indicators)

Detected non-DNS traffic on DNS port

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 7004 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original (2).eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 5980 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D27B8025-BDD6-4D95-8282-7CF5D479DA9F" "B184FC02-5235-47FD-A6D8-EEE268502D91" "7004" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

OUTLOOK.EXE (PID: 6768 cmdline: "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\5E30ZTPO\phish_alert_iocp_v1.10.14.eml" MD5: 91A5292942864110ED734005B7E005C0)

chrome.exe (PID: 6988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Feu.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3D7dfd0c65-f55e-437f-8508-1134b6c7867b%26etti%3D24%26acct%3Dd6536491-c172-4b3a-8625-af394e406227%26er%3D759e9a36-ff71-44b3-9c96-0fb31612798b&data=05%7C02%7Cadeline.deyo%40us.tel.com%7Cf9b8709f9d8740fd97a108dce1e5e99d%7C8c433003a0814dfba631100526250b1a%7C1%7C0%7C638633624803949521%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=6EsI%2FeyHBbAp%2FsJYJq8Nz9n7qI%2BJc9%2By8u%2B84fnFpcY%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1940,i,12687548481748673884,5735401961615181472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7004, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: You don't often get email from dse@eumail.docusign.net. Learn why this is important Ofir Leibovitch sent you a document to review and sign. REVIEW DOCUMENT Ofir Leibovitch ofir-l@novami.com Dear Customer, Please fill the new customer application. Thanks, Ofir l' docusign Powered by Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: 7DFDOC65F55E437F85081134B6C7867B4 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction ManagementTM. Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you have trouble signing, visit "How to Sign a Document" on our Docusign Support Center, or browse our Docusign Community for more information. Download the Docusign App

Source: https://docucdn-a.akamaihd.net/production/1ds/widgets/@ds/signing/24.8.24-3/signing-conversations.js?cs=cda8e64a

HTTP Parser: /*! for license information please see signing-conversations.js.license.txt */!function(){var e,t,n,r,o,i={6468:function(e,t,n){"use strict";var r=n(82068);object.defineproperty(t,"__esmodule",{value:!0}),t.default=void 0;var o=r(n(36488)),i=r(n(28636)),a=r(n(90564)),u=r(n(55552)),c=function(){function e(){(0,i.default)(this,e),(0,u.default)(this,"queue",new array),(0,u.default)(this,"workingonpromise",!1)}return(0,a.default)(e,[{key:"enqueue",value:function(e){var t=this;return new o.default((function(n,r){t.queue.push({worker:e,resolve:n,reject:r}),t.dequeue()}))}},{key:"dequeue",value:function(){var e=this;if(this.workingonpromise)return!1;var t=this.queue.shift();if(!t)return!1;try{this.workingonpromise=!0,t.worker().then((function(n){e.workingonpromise=!1,t.resolve(n),e.dequeue()})).catch((function(n){e.workingonpromise=!1,t.reject(n),e.dequeue()}))}catch(e){this.workingonpromise=!1,t.reject(e),this.dequeue()}return!0}}]),e}();t.default=c},92432:function(e,t,n){"use strict";var r=n(27828);object.definep...

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49790 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.16:49806 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49806 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49806 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49806 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134

Source: global traffic	DNS traffic detected: DNS query: jpn01.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: eu.docusign.net
Source: global traffic	DNS traffic detected: DNS query: docucdn-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: a.docusign.com
Source: global traffic	DNS traffic detected: DNS query: api.mixpanel.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\original (2).eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D27B8025-BDD6-4D95-8282-7CF5D479DA9F" "B184FC02-5235-47FD-A6D8-EEE268502D91" "7004" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\5E30ZTPO\phish_alert_iocp_v1.10.14.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Feu.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3D7dfd0c65-f55e-437f-8508-1134b6c7867b%26etti%3D24%26acct%3Dd6536491-c172-4b3a-8625-af394e406227%26er%3D759e9a36-ff71-44b3-9c96-0fb31612798b&data=05%7C02%7Cadeline.deyo%40us.tel.com%7Cf9b8709f9d8740fd97a108dce1e5e99d%7C8c433003a0814dfba631100526250b1a%7C1%7C0%7C638633624803949521%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=6EsI%2FeyHBbAp%2FsJYJq8Nz9n7qI%2BJc9%2By8u%2B84fnFpcY%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1940,i,12687548481748673884,5735401961615181472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "D27B8025-BDD6-4D95-8282-7CF5D479DA9F" "B184FC02-5235-47FD-A6D8-EEE268502D91" "7004" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\5E30ZTPO\phish_alert_iocp_v1.10.14.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Feu.docusign.net%2FSigning%2FEmailStart.aspx%3Fa%3D7dfd0c65-f55e-437f-8508-1134b6c7867b%26etti%3D24%26acct%3Dd6536491-c172-4b3a-8625-af394e406227%26er%3D759e9a36-ff71-44b3-9c96-0fb31612798b&data=05%7C02%7Cadeline.deyo%40us.tel.com%7Cf9b8709f9d8740fd97a108dce1e5e99d%7C8c433003a0814dfba631100526250b1a%7C1%7C0%7C638633624803949521%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=6EsI%2FeyHBbAp%2FsJYJq8Nz9n7qI%2BJc9%2By8u%2B84fnFpcY%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1940,i,12687548481748673884,5735401961615181472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Deobfuscate/Decode Files or Information	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
jpn01.safelinks.eop-tm2.outlook.com	52.102.13.60	true	false	unknown
www.google.com	142.250.74.196	true	false	unknown
api.mixpanel.com	107.178.240.159	true	false	unknown
arya-1323461286.us-west-2.elb.amazonaws.com	52.24.162.179	true	false	unknown
jpn01.safelinks.protection.outlook.com	unknown	unknown	false	unknown
eu.docusign.net	unknown	unknown	false	unknown
a.docusign.com	unknown	unknown	false	unknown
docucdn-a.akamaihd.net	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.251.5.84	unknown	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
52.39.148.28	unknown	United States	16509	AMAZON-02US	false
52.109.32.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.206.42	unknown	United States	15169	GOOGLEUS	false
52.102.13.60	jpn01.safelinks.eop-tm2.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.19.126.135	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
107.178.240.159	api.mixpanel.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
2.16.168.6	unknown	European Union	20940	AKAMAI-ASN1EU	false
52.24.162.179	arya-1323461286.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
185.81.100.28	unknown	Germany	62856	DOCUS-6-PRODUS	false
52.109.76.144	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.74.196	www.google.com	United States	15169	GOOGLEUS	false
104.208.16.95	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523383
Start date and time:	2024-10-01 14:50:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	original (2).eml
Detection:	SUS
Classification:	sus22.phis.winEML@25/81@22/70
Cookbook Comments:	Found application associated with file extension: .eml

Input	Output
URL: Email Model: jbxai

URL: https://eu.docusign.net/Signing/?ti=ac774c8c722f4d669a0896b5dea00f7a Model: jbxai	{ "brand":["docusign"], "contains_trigger_text":true, "trigger_text":"Please read the Electronic Record and Signature Disclosure.", "prominent_button_name":"CONTINUE", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://eu.docusign.net/Signing/?ti=ac774c8c722f4d669a0896b5dea00f7a Model: jbxai	{ "brand":["docusign", "Nova Ltd."], "contains_trigger_text":true, "trigger_text":"Please read the Electronic Record and Signature Disclosure.", "prominent_button_name":"CONTINUE", "text_input_field_labels":["Date of Incorporation:", "Company Registration No.", "Company VAT No.", "Company D& B No.", "Address:", "City:", "Country:", "State/Region:", "Postal Code:", "Email:", "Website:", "Buyer Contact:", "Buyer email:"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://eu.docusign.net/Signing/?ti=ac774c8c722f4d669a0896b5dea00f7a Model: jbxai	{ "phishing_score":2, "brands":"docusign", "legit_domain":"docusign.com", "classification":"wellknown", "reasons":["The brand 'docusign' is well-known and widely recognized.", "The legitimate domain for DocuSign is 'docusign.com'.", "The provided URL 'eu.docusign.net' is a subdomain of 'docusign.net', which is associated with DocuSign.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The input fields are typical for a business-related form and do not raise immediate red flags."], "brand_matches":[false], "url_match":false, "brand_input":"docusign", "input_fields":"Date of Incorporation:, Company Registration No., Company VAT No., Company D& B No., Address:, City:, Country:, State/Region:, Postal Code:, Email:, Website:, Buyer Contact:, Buyer email:"}

URL: https://eu.docusign.net/Signing/?ti=ac774c8c722f4d669a0896b5dea00f7a Model: jbxai	{ "brand":["Nova Ltd.", "docusign"], "contains_trigger_text":true, "trigger_text":"Please read the Electronic Record and Signature Disclosure.", "prominent_button_name":"CONTINUE", "text_input_field_labels":["Company VAT No.", "Company D&B No.", "Address", "City", "Country", "State/Region", "Postal Code", "Email.", "Website", "Buyer Contact", "Buyer email:"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://eu.docusign.net/Signing/?ti=ac774c8c722f4d669a0896b5dea00f7a Model: jbxai	{ "phishing_score":2, "brands":"Nova Ltd.", "legit_domain":"docusign.com", "classification":"wellknown", "reasons":["The URL 'eu.docusign.net' uses a subdomain of 'docusign.net', which is a legitimate domain associated with DocuSign.", "DocuSign is a well-known brand in the electronic signature and digital transaction management industry.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The input fields requested are typical for business-related transactions and do not raise immediate red flags."], "brand_matches":[false], "url_match":false, "brand_input":"Nova Ltd.", "input_fields":"Company VAT No., Company D&B No., Address, City, Country, State/Region, Postal Code, Email., Website, Buyer Contact, Buyer email:"}

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	modified
Size (bytes):	231348
Entropy (8bit):	4.381832331916722
Encrypted:	false
SSDEEP:
MD5:	24970DF6BDEA6749080259F9446263C0
SHA1:	E709445F18CF6A1F2A64C858323F5BADEC4A166D
SHA-256:	1E87E29F2EEAF6959E9F08DF53C06D07BF14330EE28263E96346B768EF80D064
SHA-512:	267808AD6313276F694F5812E248DFF996E3307972BFD9740FA0494E71C69FCEB089484BA31D3B094ECCE8C0E16AEEBF4BFA85407654A02EFEFA23457950399A
Malicious:	false
Reputation:	unknown
Preview:	TH02...... ..:..........SM01X...,....S..............IPM.Activity...........h...............h............H..h...............h........0...H..h\cal ...pDat...hxk..0..........h...............h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k.."k....p..i..!h.............. h..EQ....0.....#h....8.........$h0.......8....."h........ .....'h..............1h....<.........0h....4....Uk../h....h.....UkH..h...p.........-h .......\.....+h............................ ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 1 11:51:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.974290788826281
Encrypted:	false
SSDEEP:
MD5:	531E85B99F4E7B838827F93E644F0BD9
SHA1:	82E66284724161B5D9CD774A5D50F966C3872B02
SHA-256:	C241561E76D344A597B9A81AB5FF1C6DAFBC3527E8F05811EED14AE3F677415D
SHA-512:	706E0BF1ACA8DB429ABBC7E8217BE488CBEE06804A6E9CDD7E1183AFA0EB72339C195625FC69445A48AE44B9143C88D5B3801698F7D43ED91A38D96C5366D734
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....<.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IAYRf....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VAYmf....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VAYmf....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VAYmf..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VAYof...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............<......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	SMTP mail, ASCII text, with very long lines (459), with CRLF line terminators
Entropy (8bit):	6.055025109655241
TrID:	E-Mail message (Var. 1) (20512/2) 100.00%
File name:	original (2).eml
File size:	96'711 bytes
MD5:	e924e6aa535ccb1b496ae76c0a322732
SHA1:	dffc35f649765d20ada3095b4f774b5d64b6fdc1
SHA256:	e9ae0bfde26b6979061e53b5842bb0076e428e7e7ecb604e13c016ee9486281d
SHA512:	feaa1160506e20d30b6033d9146d4021db59b980f242e3131f4acde028279eb175f05c6313a82f913f2d9de98052acb64f6f9dc3467f983a238a85b9ef4668ee
SSDEEP:	1536:ve0qhkNbJhJz61To/QUKws4e94sb333F1A6RCnjDjllOi/luhHg0t93GR0d5G:veZmG4sbXF1OT/lL5R0K
TLSH:	7B934B4393C12D39CC9A5910342777BF3B7459DB0EF2187C296ABF7A5A8CCE664E1248
File Content Preview:	Return-Path: <adeline.deyo@us.tel.com>..Received: from APC01-SG2-obe.outbound.protection.outlook.com (mail-sgaapc01on2040.outbound.protection.outlook.com [40.107.215.40]).. by inbound-smtp.us-east-1.amazonaws.com with SMTP id kiuof3ka8s32vs87srbrinchpkm84

Subject:	[Phish Alert]Complete with DocuSign: New Customer Application Form
From:	adeline.deyo@us.tel.com
To:	telgreport.phishing@tel.com, db882d80-4f03-4511-be8c-78fdfd0ad442@phisher.knowbe4.com
Cc:
BCC:
Date:	Tue, 01 Oct 2024 11:31:56 +0000
Communications:	You don't often get email from dse@eumail.docusign.net. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> [https://eu.docusign.net/Member/Image.aspx?i=logo&l=88fd2d52-e57e-4327-8f67-295af082a0fd] [https://eu.docusign.net/member/Images/email/docInvite-white.png] Ofir Leibovitch sent you a document to review and sign. REVIEW DOCUMENT <https://eu.docusign.net/Signing/EmailStart.aspx?a=7dfd0c65-f55e-437f-8508-1134b6c7867b&etti=24&acct=d6536491-c172-4b3a-8625-af394e406227&er=759e9a36-ff71-44b3-9c96-0fb31612798b> Ofir Leibovitch ofir-l@novami.com Dear Customer, Please fill the new customer application. Thanks, Ofir Powered by [Docusign] Do Not Share This Email This email contains a secure link to Docusign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit Docusign.com, click 'Access Documents', and enter the security code: 7DFD0C65F55E437F85081134B6C7867B4 About Docusign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- Docusign provides a professional trusted solution for Digital Transaction Management(tm). Questions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email<https://protect.docusign.net/report-abuse?e=AUtomjpFak9GlbPL0zFFi13xV3nmBjmpWJ7kStkTxwhQahk4b-rtgmErHBDTeUto0RQAv_ZOb5ojR2nzJbP_G9SGZ9Y_nAjHF5HBe2q1jz31Zfhgm1f1RyPJBa1Bt_Jbq6q8_ItuK381d9Lnr-T_-lDzig7uW8PXs5pE-DeXSeNtI9G1oDGoVmXqajwy8874mg-TfudkiXaw1uXurA2uOgGknzbwgTBnbXO5pAINt73CIn1JUfGQIrbrN0O71fBjAB9o0pW8yWHRKY-p6XhGdIU5cawEN9ymHgxXy1O_3wQU41MQrscSbrUczPMvykY1daWl07dq4BLJ9ruc0UlmZ7TgPSCNhBdj9a9J1BPfE5p_WQtyn_7uFlrgMtiXk9bp1ltS71JN1fqZRodASQ_L5oTWmUQXVEDXdy5Afkw2spfwGUpPuRVzlNQiHboR_s0KVQ&lang=en> or read more about Declining to sign<https://support.docusign.com/en/guides/Declining-to-sign-DocuSign-Signer-Guide> and Managing notifications<https://support.docusign.com/en/articles/How-do-I-manage-my-email-notifications>. If you have trouble signing, visit "How to Sign a Document<https://support.docusign.com/s/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing?language=en_US&utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend>" on our Docusign Support Center<https://support.docusign.com/>, or browse our Docusign Community<https://community.docusign.com/esignature-111?utm_campaign=GBL_US_PRD_AWA_2405_CommunityCTA&utm_medium=email&utm_source=postsend> for more information. [https://docucdn-a.akamaihd.net/olive/images/2.62.0/global-assets/email-templates/icon-download-app.png]Download the Docusign App <https://www.docusign.com/features-and-benefits/mobile?utm_campaign=GBL_XX_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=product&utm_source=postsend> This message was sent to you by Ofir Leibovitch who is using the Docusign Electronic Signature Service. If you would rather not receive email from this sender you may contact the sender with your request.
Attachments:	phish_alert_iocp_v1.10.14.eml

Key	Value
Return-Path	<adeline.deyo@us.tel.com>
Received	from TY0PR03MB6499.apcprd03.prod.outlook.com ([fe80::9694:5383:17b0:f694]) by TY0PR03MB6499.apcprd03.prod.outlook.com ([fe80::9694:5383:17b0:f694%5]) with mapi id 15.20.8005.024; Tue, 1 Oct 2024 11:31:56 +0000
Received-SPF	pass (spfCheck: domain of us.tel.com designates 40.107.215.40 as permitted sender) client-ip=40.107.215.40; envelope-from=adeline.deyo@us.tel.com; helo=APC01-SG2-obe.outbound.protection.outlook.com;
Authentication-Results	amazonses.com; spf=pass (spfCheck: domain of us.tel.com designates 40.107.215.40 as permitted sender) client-ip=40.107.215.40; envelope-from=adeline.deyo@us.tel.com; helo=APC01-SG2-obe.outbound.protection.outlook.com; dkim=pass header.i=@us.tel.com; dmarc=pass header.from=us.tel.com;
X-SES-RECEIPT	AEFBQUFBQUFBQUFHYXBlRStWczdFVldFT2NPVmdGeW1kTjBrVmU2aFM3SUNydkZIYXg5Mnh2b0kwSjZGSU1pbjV5QzBnNDU3aS9wQUFDclR6T0xBYUs3ak9KcEt6dk84R05qZ3dQbUZ6UEExdlZYL2xDblVLU2NjWU1kVGpmeUF3SDdjMXM4b3RXYTYxZmJZQVAzUG5JY1hXMzFEUUZoeVlPc3IzN290djVNMERDM2pEV3ZJL2NmNWV6ZUZLTDZKbWNYbFNrbTRkVytwcmkraXJ6cEw0ODgxOHczNXh6cG9pUUlTMmFxb2Vjb2s5MENGb0tKZ2NrTVFOVjJwSjNqVVlDYndGcGNWYTRKQno4MGNiZWk1T3ZsMTY2RitqTHZyeG5HWXRaNkJ3aUdsNkk0MnlIVjAvenRwR1hteHlGWk9yUXpQVi9LUUJRRFE9
X-SES-DKIM-SIGNATURE	a=rsa-sha256; q=dns/txt; b=nikRKfrPhMIfIWeo5mZZEt3fWvlPsYDBP+2SSZ875hsL4wbaAxX4EMHt8h8+R+im42/r9ZlRFMsUUcQ26/YwxUAFTKDYJczSzIxz5FBBrOuFYHkoJah7ZkMO/6FL1Qj++5us+e9dgWXI0xTA5odsZrQsaJ14ZTFMR7MZG7SmGBY=; c=relaxed/simple; s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1727782323; v=1; bh=h5WRCbVrzf9IugIRCM+5uglc12nKXucONY7e34GXPmc=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT;
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uwtC5m3Zc2ysSjVcR+KwZ6xJ6hl1VKcWptkOo+F7thhYIaezu8pdW/rXPNiJsW/wJPphrAdoTIJTtgcuR7Cmz+abcTZOYsIdcpqg4rX+ugxSe5JR3xmAvAXwGuVYffucgaXkYW5ntqtij79DvCN4gTlIj0AJ4zOulqpIBMQu5N82xAwsM9/T3iJ2Hhq+lm0VX9NNVsR3x/33ouGiXWmibPfavv8RaAvAlo/t5uSk/21NbZ7CPaJ8e4DA0E0k8pEj7Tq1gWLmbdt8XmACuKYdP+dNTU7OLKRxMev7pPXeYQSJr/Mi3KvhzVwFdtJK7OgaXkvydsTXeKzW/rUyLsvA1A==
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Y5nqmQb3ZTOhyp+ZDXK1NMElqKZmrNAHDTHSL5cJxEg=; b=YfKfxzjfbWxm00A4wxZ71NNwf0Vpdai1L8T7FPy8yqGFW5QdkFlhQ3frTVop26o5L6SD1PYucjUzDC35Dmlf5gFVRvCyAs/JbKwEMSxaerk2GGO/fRtX+n4iO5Tt43pv2mclMZhGjCWsBcsqV6ns2tld+lpaDVooCuieSeWHFbRptpnFLHihM0pFN3WXo/SqtixvGXmynh+AFN/nvefyfhRFSah29Ksfi2jWmieNLpbS1ute7TF/VzBHbYxf2Xm2ta5CrvQKrRSd+09x4iU0Si68nPUFegdU9ze9FwIDyY0Nukt+YAH4XrsDJaG6sAwMRBWw4oGr8fmLPBSe+EjwCA==
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=us.tel.com; dmarc=pass action=none header.from=us.tel.com; dkim=pass header.d=us.tel.com; arc=none
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=us.tel.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Y5nqmQb3ZTOhyp+ZDXK1NMElqKZmrNAHDTHSL5cJxEg=; b=a2/QQRADBb32y9O1PEA1zveq5lc8LA+oY5DAFFnCVZY9CIb0e16qAA2B+A9AaWiO4A7hzWNUKb+u6TNQtK3v/yaoZk9Zk2r75kDPAQ/Q5MrajY8FseazLpwvg7ITGamjYqnt8rcVzE2Pc0oWHa2fjDOyocMEp/lNQwlrSA5yjS0=
From	adeline.deyo@us.tel.com
To	telgreport.phishing@tel.com, db882d80-4f03-4511-be8c-78fdfd0ad442@phisher.knowbe4.com
Subject	[Phish Alert]Complete with DocuSign: New Customer Application Form
Thread-Topic	[Phish Alert]Complete with DocuSign: New Customer Application Form
Thread-Index	AQHbE87Jbo2RStxqyEC+tG1aaWSa9bJxw2dA
Date	Tue, 01 Oct 2024 11:31:56 +0000
Message-ID	<TY0PR03MB6499E554FDA1224AD48C1432B7772@TY0PR03MB6499.apcprd03.prod.outlook.com>
References	<c992b2a72ade42dbb768e8ad289e099a@eumail.docusign.net>
In-Reply-To	<c992b2a72ade42dbb768e8ad289e099a@eumail.docusign.net>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator
authentication-results	dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=us.tel.com;
x-ms-publictraffictype	Email
x-ms-traffictypediagnostic	TY0PR03MB6499:EE_\|TYZPR03MB8645:EE_
x-ms-office365-filtering-correlation-id	d47e6c9a-3592-45eb-b104-08dce20ca7d9
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
x-microsoft-antispam	BCL:0;ARA:13230040\|376014\|1800799024\|366016\|69100299015\|38070700018;
x-microsoft-antispam-message-info	Ye0JopiQ5tkPICCNHOdezv2R0ylmyC++hlcTl+45COYHl8czrONWakxvfP2/X5GvX0IfImbz1gDF0AN4Crbdis1GWfowzredP7KUh6WcaxHGhZH6Lwb5BtbJxBs1qSyI0Fb3Q5fQujfmHynK4qFv0RGmCyAhsB5e0mjVzZlWVYRQdVCKEZbd6JxPtYiSwCIc5HROjzfb16w4zXFuQab8mkYsyjJGLYTN5mJtAjhzvHwdWqebXZdsjLepONAmKvKsam6sRru57braIAMFjs3OW00/K6aNm3eQS/IqvzDOzzN89VXQwD34AaC5DgFmjHSehbebxXIW9V0YeUXDsj8BO00DcehDCNiAAE0R9+LC39ZBsPC3yOFw94mXKVe1qSiXi600hoIpvaC7/epEwNRJOOL21GLfs2HE45cfYNNIwJsfPAAnxcfPu+obbHiqkHO+J2TUBngk6+LT7Vv3TefGtzbkKm9fMLnR9+3agLB5m9FzvePA1+EenfLLEnUB1sH3TRDt+kqkVtAeY4NHJDEj5IG9lZ71YhhYV+dE6/9KUkQlWk+5aQhSd10Nw2dah3Q6PTazOTK/4ZrQKQo1gZQwG7bhiKcgzFIvrrq2oWFCqRr9lMMvXWkBWws5NctuC2oIOiXLEGTvGGmm1mGD/2EqP40lZpbfZm5suytoxLhO26KMJsAcvPwgPle/vQ2x9nWwZU45h55HYB4b1zWvVBzRI2lL1O5HcoQ3hwckJGKLvPsXRfUwGjwQ5JlGX1VtfT7hIC+ikEMRxjqn8sVqwFvmGPOIHZ+jYGuUTmGBQNSB7PRar8GLm5buYr07V01KmvI/MZN+8nlK9IUZSMeNrwvVHDUJoM7aN7nwl4Ev2qW5ztygpQ+ugcdHuLI3pIR4ulLrUyPmJkVjUUan0jDf4TMQ5sw3NlNGIs9aCulMdujgJalZtJTGhx7Q3gfqQOunlzxjMN5gD+t7vU9Nh73rI+2ESumwvRyVXxn/qHcUfUS/uBnP+A1/OBthS+rszBSxjwTXOiC1q5rc+EpH5KhDP2S6Qjlru7oVfhtyX0Pw0dJfH/EEXnx9THNQcxlui8VnKVoEFVzs1Iss/E/NUZjreFLTOhosTkuB6yb6ddGfCzj82wJlS6JAoUzxuJZFNaxSdS5Qnqf/DSOzDOh3AXe0v6pjdKr3bfrBLwyRdModJDuSSjIx88UKf7wK4KNhwdVhFw+kIW2ZldmTeo0N+wpX7pTWT6++HEuTbZq/Zipwl/bEInk=
x-forefront-antispam-report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:TY0PR03MB6499.apcprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016)(69100299015)(38070700018);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount	1
x-ms-exchange-antispam-messagedata-0	jArMlCtl0QK/UvI6gr8oOldGX3lVHX0ENsuBozY1VzbYOF0XFnh7zBUxA9cO0s4yJFK9+yhXX4/g87m0Rs+MGIrNZ+lh9PXmWvcdOmdRoBxO7A6FcSUI6XInM6K+gEbZKiLr4afYLWtwm/vdkfD3/xdw6k79dcTxjFmBVQ9MtiV+Z4MeBmJ+8+egUngOJKa3L823X6ZmgDQXIFX0t/QrgWZOnDP7SCD6WYNy4aFqtUoT2xSX3/xzxR5gCk7JF7XvmPq+e53Hf1c1sFH/b9MedKzHLwnF8aiVvujXKLs1spvifpualLHFR2kGZ+JDbEHB708XrmD5M2/GASxuwYD72e/yv1NioZmRCOLq8YixqlPcftv6ZwjEsasGh3PH44Uy02y0v4thjKR6H2gGJuO12+FAQlroiDYB2Xy57dpnVbnMMsTOi2WT9MXwBLXvdh5V2dSFyhFWVtPhc6FuMhqDXg6FjO74h7XS5hZ8gxbhHULU1D3D4fwac1mCLjrc/LLQfU49RF1GzGvDMqFQbBcDzRdh051McA/8KHhdzWGYXw6GtOjhPW5yTJOfuj8JJD7me+a/CLW4fj0tc2v9Ttba73ttT+YjUWCSEYugHx5cWvx7ZpZd1e/5oDBYybqO0LHnqmiXdV5TwgQsMD7cXRom3m9Kw65aIRZDRf8Wa25xcxxYRZa7GrhzZrAE+K9VlmPnQcJwL2Izw67Qzopxx/CVcpGmnWLB9PyBAx7+Gp1RlTMTCpOiEPFtAn++lgXSuDxJLXT5zJnu3x7XpT0p0JoWs1nr2OyZrXEnFFOK5Zyz+UDQcu4nx1VkJNx8bWcQ43Hc36/Tsjkwd30PXI4aN6NaxMSOUPJRR49vchwpVLDvl2DO/lJwdvdLetQxThflLEGwxzFhZvs7X0yueXA/R9Bwd9Fh5f2sAFgpZHwggKH4wkiiVb8mN9HPQvb+YXJcnu2fKm+P0mKI9ZC3TEfQZl5+JsAlgiXL8HcOYvA3yQwvIR2lPo8ePMtZWm0FyPLvllOKDcbNC8DlQSGfBTYozL3Oo2460L7ZwbOujDry9wApKMYTRXMWd+w5etBx8RQp2DbdvXt0K1LzoDIuy2ffKar8Blnuungk44F9ZtywqVeGtSpaYYFsVmax2Xg57O3/jiDbR87XF/2Fkd6+iFLL0161nrQB+CHwf+te3VVc2QSgGLW8w/iQu6yMnUUPUTfEaB5fuVG1r5xvLgYuRlzWEteoGBqFCBE7a7/LAstB1LrnYS3gPBqfAWenFXB8g/etVF1bIOv7M8HaiMwasva5oiwiqkBWYBlSbqizi1rgmG1z/kC6auCdXAA+uagMfMyx5D3/E802MCDIb47bULicvaN3PlN52/ew6Q3BlLoN6r5qKueWWxQnACXf+bffFZvkTPSf+P9hMw9N5Xle/6Bl0YdLWfDRS9le2YiAmofE4UtEEhKXZnk0w39nGzqhrt+w0HdjiwK0lEBXHgg5H5WbZ+iGjbSm0xRlFrPH+N2MkPMG4cXmQ4p6kMk9c8jISU9681AimplTt2aBP5gpwRFA24vOOtk4KOj4hmAsgRNn1ZT9hbGjxMgXZ6O2dIrIqvm/h6aj
Content-Type	multipart/mixed; boundary="_004_TY0PR03MB6499E554FDA1224AD48C1432B7772TY0PR03MB6499apcp_"
MIME-Version	1.0
X-OriginatorOrg	us.tel.com
X-MS-Exchange-CrossTenant-AuthAs	Internal
X-MS-Exchange-CrossTenant-AuthSource	TY0PR03MB6499.apcprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id	d47e6c9a-3592-45eb-b104-08dce20ca7d9
X-MS-Exchange-CrossTenant-originalarrivaltime	01 Oct 2024 11:31:56.3105 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader	Hosted
X-MS-Exchange-CrossTenant-id	8c433003-a081-4dfb-a631-100526250b1a
X-MS-Exchange-CrossTenant-mailboxtype	HOSTED
X-MS-Exchange-CrossTenant-userprincipalname	ug6Nukk8Vy3659uW2EB/xkXatvlBH6z1d47Slphi/QKbWHJKbq/ffg/4hAVfVOd4pEpT3FOcUtSGUx90Pitjng==
X-MS-Exchange-Transport-CrossTenantHeadersStamped	TYZPR03MB8645

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report original (2).eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\5E30ZTPO\phish_alert_iocp_v1.10.14 (002).eml:Zone.Identifier (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\5E30ZTPO\phish_alert_iocp_v1.10.14.eml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\5E30ZTPO\phish_alert_iocp_v1.10.14.eml:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4173B987-1056-46A0-92F8-7C240E003E68}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A7ADD1E1-557E-4A86-9F39-193D696B5623}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{EC1762B6-512D-48FF-9859-DC58BA902F2B}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727787062561585600_E0D5FC5E-BFFB-4E6F-AE7A-D5ACAA82C21F.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727787062562460600_E0D5FC5E-BFFB-4E6F-AE7A-D5ACAA82C21F.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T0851020322-7004.etl

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241001T0851220301-6768.etl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 204

Chrome Cache Entry: 207

Chrome Cache Entry: 209

Chrome Cache Entry: 211

Chrome Cache Entry: 214

Chrome Cache Entry: 217

Chrome Cache Entry: 219

Chrome Cache Entry: 225

Windows Analysis Report
original (2).eml

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre